Malicious activity and indicators: beaconing, persistence, privilege escalation

Detecting an attack usually means noticing behavior, not malware files. Indicators of compromise (IoCs) are artifacts that suggest a system has been breached: known bad IP addresses and domains, file hashes, unusual registry keys, strange processes or log entries. Indicators of attack focus on behaviors in progress. As an SSCP you will review alerts and logs, so you need to recognize the common patterns of attacker activity after initial access.